@zhafron/opencode-kiro-auth 1.6.6 → 1.8.0

package/dist/infrastructure/database/account-repository.js

@@ -15,6 +15,7 @@ export class AccountRepository {
             email: r.email,
             authMethod: r.auth_method,
             region: r.region,
+            oidcRegion: r.oidc_region || undefined,
             clientId: r.client_id,
             clientSecret: r.client_secret,
             profileArn: r.profile_arn,

package/dist/kiro/oauth-idc.js

@@ -95,7 +95,16 @@ export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, inter
                     grantType: 'urn:ietf:params:oauth:grant-type:device_code'
                 })
             });
-            const tokenData = await tokenResponse.json();
+            const responseText = await tokenResponse.text().catch(() => '');
+            let tokenData = {};
+            if (responseText) {
+                try {
+                    tokenData = JSON.parse(responseText);
+                }
+                catch (parseError) {
+                    throw new Error(`Token polling failed: invalid JSON response (HTTP ${tokenResponse.status}): ${responseText.slice(0, 300)}`);
+                }
+            }
             if (tokenData.error) {
                 const errorType = tokenData.error;
                 if (errorType === 'authorization_pending') {
@@ -116,12 +125,15 @@ export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, inter
                 const error = new Error(`Token polling failed: ${errorType} - ${tokenData.error_description || ''}`);
                 throw error;
             }
-            if (tokenData.accessToken && tokenData.refreshToken) {
-                const expiresInSeconds = tokenData.expiresIn || 3600;
+            const accessToken = tokenData.access_token || tokenData.accessToken;
+            const refreshToken = tokenData.refresh_token || tokenData.refreshToken;
+            const tokenExpiresIn = tokenData.expires_in || tokenData.expiresIn;
+            if (accessToken && refreshToken) {
+                const expiresInSeconds = tokenExpiresIn || 3600;
                 const expiresAt = Date.now() + expiresInSeconds * 1000;
                 return {
-                    refreshToken: tokenData.refreshToken,
-                    accessToken: tokenData.accessToken,
+                    refreshToken,
+                    accessToken,
                     expiresAt,
                     email: 'builder-id@aws.amazon.com',
                     clientId,
@@ -131,9 +143,11 @@ export async function pollKiroIDCToken(clientId, clientSecret, deviceCode, inter
                 };
             }
             if (!tokenResponse.ok) {
-                const error = new Error(`Token request failed with status: ${tokenResponse.status}`);
+                const error = new Error(`Token request failed with status: ${tokenResponse.status} ${responseText ? `(${responseText.slice(0, 200)})` : ''}`);
                 throw error;
             }
+            // If the service returned HTTP 200 but no tokens and no error, treat as invalid response.
+            throw new Error(`Token polling failed: missing tokens in response: ${responseText ? responseText.slice(0, 300) : '[empty]'}`);
         }
         catch (error) {
             if (error instanceof Error &&

package/dist/plugin/accounts.js

@@ -27,6 +27,7 @@ export class AccountManager {
             email: r.email,
             authMethod: r.auth_method,
             region: r.region,
+            oidcRegion: r.oidc_region || undefined,
             clientId: r.client_id,
             clientSecret: r.client_secret,
             profileArn: r.profile_arn,
@@ -130,7 +131,11 @@ export class AccountManager {
                 delete a.unhealthyReason;
                 delete a.recoveryTime;
             }
-            kiroDb.upsertAccount(a).catch(() => { });
+            kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+                method: 'updateUsage',
+                email: a.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     addAccount(a) {
@@ -139,14 +144,22 @@ export class AccountManager {
             this.accounts.push(a);
         else
             this.accounts[i] = a;
-        kiroDb.upsertAccount(a).catch(() => { });
+        kiroDb.upsertAccount(a).catch((e) => logger.warn('DB write failed', {
+            method: 'addAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     removeAccount(a) {
         const removedIndex = this.accounts.findIndex((x) => x.id === a.id);
         if (removedIndex === -1)
             return;
         this.accounts = this.accounts.filter((x) => x.id !== a.id);
-        kiroDb.deleteAccount(a.id).catch(() => { });
+        kiroDb.deleteAccount(a.id).catch((e) => logger.warn('DB write failed', {
+            method: 'removeAccount',
+            email: a.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
         if (this.accounts.length === 0)
             this.cursor = 0;
         else if (this.cursor >= this.accounts.length)
@@ -172,15 +185,27 @@ export class AccountManager {
             acc.isHealthy = true;
             delete acc.unhealthyReason;
             delete acc.recoveryTime;
-            kiroDb.upsertAccount(acc).catch(() => { });
-            writeToKiroCli(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
+            writeToKiroCli(acc).catch((e) => logger.warn('CLI write failed', {
+                method: 'updateFromAuth',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markRateLimited(a, ms) {
         const acc = this.accounts.find((x) => x.id === a.id);
         if (acc) {
             acc.rateLimitResetTime = Date.now() + ms;
-            kiroDb.upsertAccount(acc).catch(() => { });
+            kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+                method: 'markRateLimited',
+                email: acc.email,
+                error: e instanceof Error ? e.message : String(e)
+            }));
         }
     }
     markUnhealthy(a, reason, recovery) {
@@ -208,7 +233,11 @@ export class AccountManager {
                 acc.recoveryTime = recovery || Date.now() + 3600000;
             }
         }
-        kiroDb.upsertAccount(acc).catch(() => { });
+        kiroDb.upsertAccount(acc).catch((e) => logger.warn('DB write failed', {
+            method: 'markUnhealthy',
+            email: acc.email,
+            error: e instanceof Error ? e.message : String(e)
+        }));
     }
     async saveToDisk() {
         await kiroDb.batchUpsertAccounts(this.accounts);
@@ -227,6 +256,7 @@ export class AccountManager {
             expires: a.expiresAt,
             authMethod: a.authMethod,
             region: a.region,
+            oidcRegion: a.oidcRegion,
             profileArn: a.profileArn,
             clientId: a.clientId,
             clientSecret: a.clientSecret,

package/dist/plugin/config/schema.d.ts

@@ -6,6 +6,8 @@ export type Region = z.infer<typeof RegionSchema>;
 export declare const KiroConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     idc_start_url: z.ZodOptional<z.ZodString>;
+    idc_region: z.ZodOptional<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
+    idc_profile_arn: z.ZodOptional<z.ZodString>;
     account_selection_strategy: z.ZodDefault<z.ZodEnum<["sticky", "round-robin", "lowest-usage"]>>;
     default_region: z.ZodDefault<z.ZodEnum<["us-east-1", "us-east-2", "us-west-1", "us-west-2", "af-south-1", "ap-east-1", "ap-south-2", "ap-southeast-3", "ap-southeast-5", "ap-southeast-4", "ap-south-1", "ap-southeast-6", "ap-northeast-3", "ap-northeast-2", "ap-southeast-1", "ap-southeast-2", "ap-east-2", "ap-southeast-7", "ap-northeast-1", "ca-central-1", "ca-west-1", "eu-central-1", "eu-west-1", "eu-west-2", "eu-south-1", "eu-west-3", "eu-south-2", "eu-north-1", "eu-central-2", "il-central-1", "mx-central-1", "me-south-1", "me-central-1", "sa-east-1"]>>;
     rate_limit_retry_delay_ms: z.ZodDefault<z.ZodNumber>;
@@ -35,9 +37,13 @@ export declare const KiroConfigSchema: z.ZodObject<{
     enable_log_api_request: boolean;
     $schema?: string | undefined;
     idc_start_url?: string | undefined;
+    idc_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
+    idc_profile_arn?: string | undefined;
 }, {
     $schema?: string | undefined;
     idc_start_url?: string | undefined;
+    idc_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
+    idc_profile_arn?: string | undefined;
     account_selection_strategy?: "sticky" | "round-robin" | "lowest-usage" | undefined;
     default_region?: "us-east-1" | "us-east-2" | "us-west-1" | "us-west-2" | "af-south-1" | "ap-east-1" | "ap-south-2" | "ap-southeast-3" | "ap-southeast-5" | "ap-southeast-4" | "ap-south-1" | "ap-southeast-6" | "ap-northeast-3" | "ap-northeast-2" | "ap-southeast-1" | "ap-southeast-2" | "ap-east-2" | "ap-southeast-7" | "ap-northeast-1" | "ca-central-1" | "ca-west-1" | "eu-central-1" | "eu-west-1" | "eu-west-2" | "eu-south-1" | "eu-west-3" | "eu-south-2" | "eu-north-1" | "eu-central-2" | "il-central-1" | "mx-central-1" | "me-south-1" | "me-central-1" | "sa-east-1" | undefined;
     rate_limit_retry_delay_ms?: number | undefined;

package/dist/plugin/config/schema.js

@@ -39,6 +39,8 @@ export const RegionSchema = z.enum([
 export const KiroConfigSchema = z.object({
     $schema: z.string().optional(),
     idc_start_url: z.string().url().optional(),
+    idc_region: RegionSchema.optional(),
+    idc_profile_arn: z.string().optional(),
     account_selection_strategy: AccountSelectionStrategySchema.default('lowest-usage'),
     default_region: RegionSchema.default('us-east-1'),
     rate_limit_retry_delay_ms: z.number().min(1000).max(60000).default(5000),

package/dist/plugin/logger.js

@@ -14,7 +14,22 @@ const writeToFile = (level, message, ...args) => {
         mkdirSync(dir, { recursive: true });
         const path = join(dir, 'plugin.log');
         const timestamp = new Date().toISOString();
-        const content = `[${timestamp}] ${level}: ${message} ${args.map((a) => (typeof a === 'object' ? JSON.stringify(a) : String(a))).join(' ')}\n`;
+        const content = `[${timestamp}] ${level}: ${message} ${args
+            .map((a) => {
+            if (a instanceof Error) {
+                return `${a.name}: ${a.message}${a.stack ? `\n${a.stack}` : ''}`;
+            }
+            if (typeof a === 'object') {
+                try {
+                    return JSON.stringify(a);
+                }
+                catch {
+                    return '[Unserializable object]';
+                }
+            }
+            return String(a);
+        })
+            .join(' ')}\n`;
         appendFileSync(path, content);
     }
     catch (e) { }

package/dist/plugin/request.js

@@ -1,6 +1,6 @@
 import * as crypto from 'crypto';
 import * as os from 'os';
-import { KIRO_CONSTANTS } from '../constants.js';
+import { KIRO_CONSTANTS, buildUrl, extractRegionFromArn } from '../constants.js';
 import { buildHistory, extractToolNamesFromHistory, historyHasToolCalling, injectSystemPrompt, truncateHistory } from '../infrastructure/transformers/history-builder.js';
 import { findOriginalToolCall, getContentText, mergeAdjacentMessages, truncate } from '../infrastructure/transformers/message-transformer.js';
 import { convertToolsToCodeWhisperer, deduplicateToolResults } from '../infrastructure/transformers/tool-transformer.js';
@@ -135,6 +135,8 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
             }
         }
     };
+    if (auth.profileArn)
+        request.profileArn = auth.profileArn;
     const toolUsesInHistory = history.flatMap((h) => h.assistantResponseMessage?.toolUses || []);
     const allToolUseIdsInHistory = new Set(toolUsesInHistory.map((tu) => tu.toolUseId));
     const finalCurTrs = [];
@@ -219,7 +221,7 @@ export function transformToCodeWhisperer(url, body, model, auth, think = false,
     const osN = osP === 'win32' ? `windows#${osR}` : osP === 'darwin' ? `macos#${osR}` : `${osP}#${osR}`;
     const ua = `aws-sdk-js/3.738.0 ua/2.1 os/${osN} lang/js md/nodejs#${nodeV} api/codewhisperer#3.738.0 m/E KiroIDE`;
     return {
-        url: KIRO_CONSTANTS.BASE_URL.replace('{{region}}', auth.region),
+        url: buildUrl(KIRO_CONSTANTS.BASE_URL, extractRegionFromArn(auth.profileArn) ?? auth.region),
         init: {
             method: 'POST',
             headers: {

package/dist/plugin/storage/migrations.js

@@ -3,6 +3,8 @@ export function runMigrations(db) {
     migrateRealEmailColumn(db);
     migrateUsageTable(db);
     migrateStartUrlColumn(db);
+    migrateOidcRegionColumn(db);
+    migrateDropRefreshTokenUniqueIndex(db);
 }
 function migrateToUniqueRefreshToken(db) {
     const hasIndex = db
@@ -62,7 +64,8 @@ function migrateRealEmailColumn(db) {
             db.run(`
           CREATE TABLE accounts_new (
             id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
-            region TEXT NOT NULL, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+            region TEXT NOT NULL, oidc_region TEXT, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+            start_url TEXT,
             refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
             rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
             recovery_time INTEGER, fail_count INTEGER DEFAULT 0, last_used INTEGER DEFAULT 0,
@@ -70,8 +73,8 @@ function migrateRealEmailColumn(db) {
           )
         `);
             db.run(`
-          INSERT INTO accounts_new (id, email, auth_method, region, client_id, client_secret, profile_arn, refresh_token, access_token, expires_at, rate_limit_reset, is_healthy, unhealthy_reason, recovery_time, fail_count, last_used, used_count, limit_count, last_sync)
-          SELECT id, email, auth_method, region, client_id, client_secret, profile_arn, refresh_token, access_token, expires_at, COALESCE(rate_limit_reset, 0), COALESCE(is_healthy, 1), unhealthy_reason, recovery_time, COALESCE(fail_count, 0), COALESCE(last_used, 0), 0, 0, 0 FROM accounts
+          INSERT INTO accounts_new (id, email, auth_method, region, oidc_region, client_id, client_secret, profile_arn, start_url, refresh_token, access_token, expires_at, rate_limit_reset, is_healthy, unhealthy_reason, recovery_time, fail_count, last_used, used_count, limit_count, last_sync)
+          SELECT id, email, auth_method, region, NULL, client_id, client_secret, profile_arn, NULL, refresh_token, access_token, expires_at, COALESCE(rate_limit_reset, 0), COALESCE(is_healthy, 1), unhealthy_reason, recovery_time, COALESCE(fail_count, 0), COALESCE(last_used, 0), 0, 0, 0 FROM accounts
         `);
             db.run('DROP TABLE accounts');
             db.run('ALTER TABLE accounts_new RENAME TO accounts');
@@ -115,3 +118,38 @@ function migrateStartUrlColumn(db) {
         db.run('ALTER TABLE accounts ADD COLUMN start_url TEXT');
     }
 }
+function migrateOidcRegionColumn(db) {
+    const columns = db.prepare('PRAGMA table_info(accounts)').all();
+    const names = new Set(columns.map((c) => c.name));
+    if (!names.has('oidc_region')) {
+        db.run('ALTER TABLE accounts ADD COLUMN oidc_region TEXT');
+    }
+    // Backfill: historically `region` was used for both service + OIDC.
+    db.run('UPDATE accounts SET oidc_region = region WHERE oidc_region IS NULL OR oidc_region = \"\"');
+}
+function migrateDropRefreshTokenUniqueIndex(db) {
+    // Drop the UNIQUE index on refresh_token — it was only needed for ON CONFLICT(refresh_token)
+    // upsert mechanics. Now that we use ON CONFLICT(id), this index is unnecessary and actively
+    // harmful: duplicate rows (same account, different legacy vs hash id) share the same
+    // refresh_token, causing UNIQUE constraint violations on every upsert.
+    db.run('DROP INDEX IF EXISTS idx_refresh_token_unique');
+    // Clean up duplicate rows: same email + same refresh_token but different ids.
+    // Keep the deterministic hash id (64-char hex), delete legacy kiro-cli-sync-* rows.
+    const duplicates = db
+        .prepare(`SELECT email, refresh_token FROM accounts
+       GROUP BY email, refresh_token
+       HAVING COUNT(*) > 1`)
+        .all();
+    for (const dup of duplicates) {
+        const rows = db
+            .prepare(`SELECT id FROM accounts WHERE email = ? AND refresh_token = ?
+         ORDER BY
+           CASE WHEN id LIKE 'kiro-cli-sync-%' THEN 1 ELSE 0 END ASC,
+           last_used DESC, expires_at DESC`)
+            .all(dup.email, dup.refresh_token);
+        // Keep the first row (deterministic hash id preferred), delete the rest
+        for (const row of rows.slice(1)) {
+            db.prepare('DELETE FROM accounts WHERE id = ?').run(row.id);
+        }
+    }
+}

package/dist/plugin/storage/sqlite.js

@@ -28,7 +28,7 @@ export class KiroDatabase {
         this.db.run(`
       CREATE TABLE IF NOT EXISTS accounts (
         id TEXT PRIMARY KEY, email TEXT NOT NULL, auth_method TEXT NOT NULL,
-        region TEXT NOT NULL, client_id TEXT, client_secret TEXT, profile_arn TEXT,
+        region TEXT NOT NULL, oidc_region TEXT, client_id TEXT, client_secret TEXT, profile_arn TEXT,
         start_url TEXT,
         refresh_token TEXT NOT NULL, access_token TEXT NOT NULL, expires_at INTEGER NOT NULL,
         rate_limit_reset INTEGER DEFAULT 0, is_healthy INTEGER DEFAULT 1, unhealthy_reason TEXT,
@@ -45,22 +45,22 @@ export class KiroDatabase {
         this.db
             .prepare(`
       INSERT INTO accounts (
-        id, email, auth_method, region, client_id, client_secret,
+        id, email, auth_method, region, oidc_region, client_id, client_secret,
         profile_arn, start_url, refresh_token, access_token, expires_at, rate_limit_reset,
         is_healthy, unhealthy_reason, recovery_time, fail_count, last_used,
         used_count, limit_count, last_sync
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT(refresh_token) DO UPDATE SET
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
         id=excluded.id, email=excluded.email, auth_method=excluded.auth_method,
-        region=excluded.region, client_id=excluded.client_id, client_secret=excluded.client_secret,
-        profile_arn=excluded.profile_arn, start_url=excluded.start_url,
+        region=excluded.region, oidc_region=excluded.oidc_region, client_id=excluded.client_id, client_secret=excluded.client_secret,
+        profile_arn=excluded.profile_arn, start_url=excluded.start_url, refresh_token=excluded.refresh_token,
         access_token=excluded.access_token, expires_at=excluded.expires_at,
         rate_limit_reset=excluded.rate_limit_reset, is_healthy=excluded.is_healthy,
         unhealthy_reason=excluded.unhealthy_reason, recovery_time=excluded.recovery_time,
         fail_count=excluded.fail_count, last_used=excluded.last_used,
         used_count=excluded.used_count, limit_count=excluded.limit_count, last_sync=excluded.last_sync
     `)
-            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.startUrl || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
+            .run(acc.id, acc.email, acc.authMethod, acc.region, acc.oidcRegion || null, acc.clientId || null, acc.clientSecret || null, acc.profileArn || null, acc.startUrl || null, acc.refreshToken, acc.accessToken, acc.expiresAt, acc.rateLimitResetTime || 0, acc.isHealthy ? 1 : 0, acc.unhealthyReason || null, acc.recoveryTime || null, acc.failCount || 0, acc.lastUsed || 0, acc.usedCount || 0, acc.limitCount || 0, acc.lastSync || 0);
     }
     async upsertAccount(acc) {
         await withDatabaseLock(this.path, async () => {
@@ -109,6 +109,7 @@ export class KiroDatabase {
             email: row.email,
             authMethod: row.auth_method,
             region: row.region,
+            oidcRegion: row.oidc_region || undefined,
             clientId: row.client_id,
             clientSecret: row.client_secret,
             profileArn: row.profile_arn,

package/dist/plugin/sync/kiro-cli-profile.d.ts

@@ -0,0 +1 @@
+export declare function readActiveProfileArnFromKiroCli(): string | undefined;

package/dist/plugin/sync/kiro-cli-profile.js

@@ -0,0 +1,30 @@
+import { Database } from 'bun:sqlite';
+import { existsSync } from 'node:fs';
+import { getCliDbPath, safeJsonParse } from './kiro-cli-parser';
+export function readActiveProfileArnFromKiroCli() {
+    const dbPath = getCliDbPath();
+    if (!existsSync(dbPath))
+        return undefined;
+    let cliDb;
+    try {
+        cliDb = new Database(dbPath, { readonly: true });
+        cliDb.run('PRAGMA busy_timeout = 5000');
+        const row = cliDb
+            .prepare('SELECT value FROM state WHERE key = ?')
+            .get('api.codewhisperer.profile');
+        const parsed = safeJsonParse(row?.value);
+        const arn = parsed?.arn || parsed?.profileArn || parsed?.profile_arn;
+        return typeof arn === 'string' && arn.trim() ? arn.trim() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        try {
+            cliDb?.close();
+        }
+        catch {
+            // ignore
+        }
+    }
+}

package/dist/plugin/sync/kiro-cli.js

@@ -1,10 +1,12 @@
 import { Database } from 'bun:sqlite';
 import { existsSync } from 'node:fs';
+import { extractRegionFromArn, normalizeRegion } from '../../constants';
 import { createDeterministicAccountId } from '../accounts';
 import * as logger from '../logger';
 import { kiroDb } from '../storage/sqlite';
 import { fetchUsageLimits } from '../usage';
 import { findClientCredsRecursive, getCliDbPath, makePlaceholderEmail, normalizeExpiresAt, safeJsonParse } from './kiro-cli-parser';
+import { readActiveProfileArnFromKiroCli } from './kiro-cli-profile';
 export async function syncFromKiroCli() {
     const dbPath = getCliDbPath();
     if (!existsSync(dbPath))
@@ -13,6 +15,19 @@ export async function syncFromKiroCli() {
         const cliDb = new Database(dbPath, { readonly: true });
         cliDb.run('PRAGMA busy_timeout = 5000');
         const rows = cliDb.prepare('SELECT key, value FROM auth_kv').all();
+        let activeProfileArn;
+        try {
+            const stateRow = cliDb
+                .prepare('SELECT value FROM state WHERE key = ?')
+                .get('api.codewhisperer.profile');
+            const parsed = safeJsonParse(stateRow?.value);
+            const arn = parsed?.arn || parsed?.profileArn || parsed?.profile_arn;
+            if (typeof arn === 'string' && arn.trim())
+                activeProfileArn = arn.trim();
+        }
+        catch {
+            // Ignore state read failures; token import can proceed.
+        }
         const deviceRegRow = rows.find((r) => typeof r?.key === 'string' && r.key.includes('device-registration'));
         const deviceReg = safeJsonParse(deviceRegRow?.value);
         const regCreds = deviceReg ? findClientCredsRecursive(deviceReg) : {};
@@ -23,8 +38,16 @@ export async function syncFromKiroCli() {
                     continue;
                 const isIdc = row.key.includes('odic');
                 const authMethod = isIdc ? 'idc' : 'desktop';
-                const region = data.region || 'us-east-1';
-                const profileArn = data.profile_arn || data.profileArn;
+                const oidcRegion = normalizeRegion(data.region);
+                let profileArn = data.profile_arn || data.profileArn;
+                if (!profileArn && isIdc)
+                    profileArn = activeProfileArn || readActiveProfileArnFromKiroCli();
+                const serviceRegion = extractRegionFromArn(profileArn) || oidcRegion;
+                const startUrl = typeof data.start_url === 'string'
+                    ? data.start_url
+                    : typeof data.startUrl === 'string'
+                        ? data.startUrl
+                        : undefined;
                 const accessToken = data.access_token || data.accessToken || '';
                 const refreshToken = data.refresh_token || data.refreshToken;
                 if (!refreshToken)
@@ -46,7 +69,7 @@ export async function syncFromKiroCli() {
                         access: accessToken,
                         expires: cliExpiresAt,
                         authMethod,
-                        region,
+                        region: serviceRegion,
                         profileArn,
                         clientId,
                         clientSecret,
@@ -63,7 +86,8 @@ export async function syncFromKiroCli() {
                 catch (e) {
                     logger.warn('Kiro CLI sync: failed to fetch usage/email; falling back', {
                         authMethod,
-                        region
+                        serviceRegion,
+                        oidcRegion
                     });
                     logger.debug('Kiro CLI sync: usage fetch error', e);
                 }
@@ -80,10 +104,10 @@ export async function syncFromKiroCli() {
                         email = existing.email;
                     }
                     else {
-                        email = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                        email = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
                     }
                 }
-                const resolvedEmail = email || makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                const resolvedEmail = email || makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
                 const id = createDeterministicAccountId(resolvedEmail, authMethod, clientId, profileArn);
                 const existingById = all.find((a) => a.id === id);
                 if (existingById &&
@@ -91,7 +115,7 @@ export async function syncFromKiroCli() {
                     existingById.expires_at >= cliExpiresAt)
                     continue;
                 if (usageOk) {
-                    const placeholderEmail = makePlaceholderEmail(authMethod, region, clientId, profileArn);
+                    const placeholderEmail = makePlaceholderEmail(authMethod, serviceRegion, clientId, profileArn);
                     const placeholderId = createDeterministicAccountId(placeholderEmail, authMethod, clientId, profileArn);
                     if (placeholderId !== id) {
                         const placeholderRow = all.find((a) => a.id === placeholderId);
@@ -100,7 +124,8 @@ export async function syncFromKiroCli() {
                                 id: placeholderId,
                                 email: placeholderRow.email,
                                 authMethod,
-                                region: placeholderRow.region || region,
+                                region: placeholderRow.region || serviceRegion,
+                                oidcRegion: placeholderRow.oidc_region || oidcRegion,
                                 clientId,
                                 clientSecret,
                                 profileArn,
@@ -123,10 +148,12 @@ export async function syncFromKiroCli() {
                     id,
                     email: resolvedEmail,
                     authMethod,
-                    region,
+                    region: serviceRegion,
+                    oidcRegion,
                     clientId,
                     clientSecret,
                     profileArn,
+                    startUrl,
                     refreshToken,
                     accessToken,
                     expiresAt: cliExpiresAt,

package/dist/plugin/token.js

@@ -3,8 +3,9 @@ import { KiroTokenRefreshError } from './errors';
 export async function refreshAccessToken(auth) {
     const p = decodeRefreshToken(auth.refresh);
     const isIdc = auth.authMethod === 'idc';
+    const oidcRegion = auth.oidcRegion || auth.region;
     const url = isIdc
-        ? `https://oidc.${auth.region}.amazonaws.com/token`
+        ? `https://oidc.${oidcRegion}.amazonaws.com/token`
         : `https://prod.${auth.region}.auth.desktop.kiro.dev/refreshToken`;
     if (isIdc && (!p.clientId || !p.clientSecret)) {
         throw new KiroTokenRefreshError('Missing creds', 'MISSING_CREDENTIALS');
@@ -62,6 +63,8 @@ export async function refreshAccessToken(auth) {
             expires: Date.now() + (d.expires_in || d.expiresIn || 3600) * 1000,
             authMethod: auth.authMethod,
             region: auth.region,
+            oidcRegion: auth.oidcRegion,
+            profileArn: auth.profileArn,
             clientId: auth.clientId,
             clientSecret: auth.clientSecret,
             email: auth.email || d.userInfo?.email

package/dist/plugin/types.d.ts

@@ -8,6 +8,7 @@ export interface KiroAuthDetails {
     expires: number;
     authMethod: KiroAuthMethod;
     region: KiroRegion;
+    oidcRegion?: KiroRegion;
     clientId?: string;
     clientSecret?: string;
     email?: string;
@@ -25,6 +26,7 @@ export interface ManagedAccount {
     email: string;
     authMethod: KiroAuthMethod;
     region: KiroRegion;
+    oidcRegion?: KiroRegion;
     clientId?: string;
     clientSecret?: string;
     profileArn?: string;

package/dist/plugin/usage.js

@@ -1,7 +1,12 @@
 export async function fetchUsageLimits(auth) {
-    const url = `https://q.${auth.region}.amazonaws.com/getUsageLimits?isEmailRequired=true&origin=AI_EDITOR&resourceType=AGENTIC_REQUEST`;
+    const url = new URL(`https://q.${auth.region}.amazonaws.com/getUsageLimits`);
+    url.searchParams.set('isEmailRequired', 'true');
+    url.searchParams.set('origin', 'AI_EDITOR');
+    url.searchParams.set('resourceType', 'AGENTIC_REQUEST');
+    if (auth.profileArn)
+        url.searchParams.set('profileArn', auth.profileArn);
     try {
-        const res = await fetch(url, {
+        const res = await fetch(url.toString(), {
             method: 'GET',
             headers: {
                 Authorization: `Bearer ${auth.access}`,
@@ -10,8 +15,18 @@ export async function fetchUsageLimits(auth) {
                 'amz-sdk-request': 'attempt=1; max=1'
             }
         });
-        if (!res.ok)
-            throw new Error(`Status: ${res.status}`);
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            const requestId = res.headers.get('x-amzn-requestid') ||
+                res.headers.get('x-amzn-request-id') ||
+                res.headers.get('x-amz-request-id') ||
+                '';
+            const errType = res.headers.get('x-amzn-errortype') || res.headers.get('x-amzn-error-type') || '';
+            const msg = body && body.length > 0
+                ? `${body.slice(0, 2000)}${body.length > 2000 ? '…' : ''}`
+                : `HTTP ${res.status}`;
+            throw new Error(`Status: ${res.status}${errType ? ` (${errType})` : ''}${requestId ? ` [${requestId}]` : ''}: ${msg}`);
+        }
         const data = await res.json();
         let usedCount = 0, limitCount = 0;
         if (Array.isArray(data.usageBreakdownList)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhafron/opencode-kiro-auth",
-  "version": "1.6.6",
+  "version": "1.8.0",
   "description": "OpenCode plugin for AWS Kiro (CodeWhisperer) providing access to Claude models",
   "type": "module",
   "main": "dist/index.js",

package/dist/plugin/cli.d.ts

@@ -1,8 +0,0 @@
-export declare function promptAddAnotherAccount(currentCount: number): Promise<boolean>;
-export declare function promptDeleteAccount(accounts: ExistingAccountInfo[]): Promise<number[] | null>;
-export type LoginMode = 'add' | 'fresh' | 'delete';
-export interface ExistingAccountInfo {
-    email?: string;
-    index: number;
-}
-export declare function promptLoginMode(existingAccounts: ExistingAccountInfo[]): Promise<LoginMode>;